How we work
Fast, found, protected. No promises. Just proof.
Everyone says their websites are secure. We show the grades, and you can run every test again yourself, in one click.
Scalia Security Check : 99/100
Scalia Security Check
- A+Mozilla Observatory
- A+securityheaders.com
- ASSL Labs (Qualys)
How we build
Code written for you. Not a theme and twenty plugins.
Custom-built, no plugins
Every website is built with Next.js and React, the tools of the big platforms. There are no plugins to update and no bought theme: fewer parts, so fewer ways in.
Fixed without waiting
When a flaw is published in our tools, the fix goes out without waiting. On 3 November 2026, seven flaws were announced in Next.js: our websites were up to date the next morning.
Fast everywhere
Images and files prepared in advance and served from a worldwide network: the website loads fast, even on a phone over 4G, with no server to maintain.
Found on Google and by AI
Text search engines can read, structured data, a sitemap and speed: the website is built for Google as well as for ChatGPT, Gemini or Perplexity.
Cybersecurity
Our grades. Check them yourself.
These three public tools are the reference for security experts. They do not belong to us: click, and the test of scalia.do runs again live.
- Run the test again
Mozilla Observatory
Grade A+
- 115/100
- 12 of 12 tests passed
Checked on November 5, 2026
- Run the test again
securityheaders.com
Grade A+
- 6 of 6 security headers
- No warnings
Checked on November 5, 2026
- Run the test again
SSL Labs (Qualys)
Grade A
- TLS 1.3 and TLS 1.2
- Certificate valid until 3 December 2026
Checked on November 5, 2026
What protects scalia.do, and what we install for our clients
- Admin sign-in hidden behind a secret address, with a code received by email at every sign-in.
- Firewall: past 5 sign-in attempts a minute, the address is blocked.
- Encryption enforced everywhere (HTTPS and HSTS), never a page in clear text.
- Content Security Policy (CSP) and browser protections on every page.
- Emails protected against spoofing: SPF, DKIM, DMARC and MTA-STS.
- A public contact to report a flaw (security.txt), like large companies.
The ranking
The agencies, on the same test. Their own website.
An agency that protects its own website poorly: will it protect yours? We ran the websites of big agencies from France, the Dominican Republic, the United States and Canada through the same test, ours included.
- lg2.
com93/100Mozilla B · Headers A+2 
99/100Mozilla A+ · Headers A+1- rightpoint.
com93/100Mozilla B · Headers A+3
The agency's own website runs on WordPress.
Measured on November 5, 2026. Ranked by Scalia Security Check score, then by Mozilla score, then by securityheaders. Each agency is named by its own domain. The test only looks at what any browser sees: no sign-in attempted, nothing forced. An agency that fixes its website moves up at the next test.
Are you one of these agencies? We run the tests again every week. Fixed your site and want to show up to date sooner? Write to us: we run the test again right away.
Ask for a new testYour turn
Test your website. With the same tools.
Run our free test: your score out of 100, your place in the ranking and every problem explained. Or open the three public tests directly.
Run the Scalia Security CheckThe WordPress case
Your WordPress website: where is the problem?
WordPress is not bad in itself. The problem is a website delivered, then forgotten: every plugin is one more door, and nobody checks that it is shut. What we see most often:
- Serious
Updates running late
Update available · 3 pluginsWordPress itself, the theme or a plugin is no longer up to date, while its flaws are public.
- Serious
The front door on display
/wp-admin · /wp-login.phpThe /wp-admin sign-in page is open to everyone, and nothing slows down the robots trying passwords.
- Serious
Account names on show
/wp-json/wp/v2/usersThe list of admin accounts can be read at a public address: all that is left is to guess the password.
- Medium
A server past its age
X-Powered-By: PHP/7.4A version of PHP that no longer receives security fixes, and that sometimes shows in the website’s headers.
- Medium
No browser protection
Strict-Transport-Security: missingNo HSTS, no CSP, no protection against being shown in a trap frame: the basic settings are missing.
In our ranking, 15 of the 40 agencies run a WordPress website themselves, including 8 of the 17 Dominican ones. The best placed, artefact.com, comes 5th with 91/100: a WordPress site can be well kept, but it keeps small weaknesses (B at Mozilla).
Transparency
How the Scalia Security Check score is calculated.
A website starts at 100 points. Each problem found takes some away, according to how serious it is. The same rules for everyone, us included.
- Security headersHSTS, CSP, frame protection, content type, referrer, permissions.
- EncryptionRedirect to HTTPS, valid certificate, old TLS versions refused.
- CookiesSecure, HttpOnly and SameSite protections on session cookies.
- Email and domainSPF, DMARC, MTA-STS, CAA, and DNSSEC where the domain allows it.
- What the website gives awayVersions the server shows, sensitive areas in robots.txt, a security contact (security.txt), external scripts without an integrity check.
- 90–100Well protected. What is left is detail.
- 70–89The basics are there. A few protections to strengthen.
- under 70Flaws to fix, more or less urgently depending on the score.
A project with Scalia
Four steps. No surprises.
- 01
We talk about your project
A conversation to understand your business, your customers and what the website should get them to do.
- 02
The mockup, at no cost
Ready in 72 hours. You see your website before you commit.
- 03
Live in about a week
Fast, protected and tested on phone and computer, with the security grades above.
- 04
Follow-up and updates
We watch the published flaws and keep your website updated: it does not grow old in a corner.